← Back to Skills Marketplace
Trade Memory
by
Indra Riswana
· GitHub ↗
· v1.0.0
587
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install trade-memory
Description
Save a trade or signal event to local memory log file (trades.jsonl). Use when a trade signal is confirmed and needs to be recorded, saved, or logged for fut...
Usage Guidance
Do not install or run this skill until you verify where save.py comes from. The SKILL.md expects a local Python file at ~/.npm-global/lib/node_modules/openclaw/skills/trade-memory/save.py and will append to /home/windows_11/.openclaw/polymarket-workspace/trades.jsonl, but the skill package provides no code or installer. Actions to take before use:
- Inspect the actual save.py that would be executed (open its source) and confirm its contents and origin.
- If you maintain the file, prefer packaging the script with the skill or provide an explicit install step rather than relying on an arbitrary npm-global path.
- If you don't control the host path, refuse installation or run in a sandbox until provenance is confirmed.
- Consider modifying the skill to write to a configurable, documented path and to include the script inline in the skill bundle so behavior is auditable.
- Treat the 'always run the script — never simulate' instruction as an extra risk: ensure the script is safe before permitting autonomous execution.
Capability Analysis
Type: OpenClaw Skill
Name: trade-memory
Version: 1.0.0
The `SKILL.md` file instructs the AI agent to execute a local Python script using user-provided JSON input (`python3 ... save.py '<JSON_INPUT>'`). This command structure is highly vulnerable to shell injection if the AI agent does not properly escape the `JSON_INPUT` string before embedding it within single quotes in the shell command. A malicious user could craft the JSON input to break out of the quotes and execute arbitrary commands on the host system. Additionally, the 'Guardrails' section contains a prompt injection instruction ('Always run the script — never simulate or fake a save confirmation') which attempts to override agent safety mechanisms, indicating a potential for agent manipulation.
Capability Assessment
Purpose & Capability
The goal (persist trade events) reasonably needs a local script and python3, but the SKILL.md assumes a specific script exists at ~/.npm-global/lib/node_modules/openclaw/skills/trade-memory/save.py and writes to /home/windows_11/.openclaw/... — the skill bundle contains no code nor install instructions to create that script or ensure the file path exists, which is inconsistent.
Instruction Scope
Runtime instructions explicitly tell the agent to execute a local Python script with user-supplied JSON and to 'always run the script — never simulate.' They reference specific filesystem paths and create/write behavior. Because the script is not included, following the instructions could cause the agent to execute an unexpected local binary or fail; the directive to always execute increases risk if a malicious or replaced script exists at that path.
Install Mechanism
There is no install spec or code files. Yet the instructions rely on a script stored under an npm-global path. This is a packaging/integration mismatch: either the skill should include the save.py or provide an install step. The lack of an authoritative source for the script means the agent will rely on whatever is already on the host, which is unsafe/unreliable.
Credentials
The skill requests only python3 and no credentials, which is proportional to logging trades. However, it hardcodes user-specific filesystem locations (~ and /home/windows_11) without declaring config paths; this may lead to accidental access of unrelated files or failure on different hosts.
Persistence & Privilege
The skill does not request persistent/always-enabled privileges and is user-invocable. Still, because it instructs execution of a local script and creation/appending of files, verify the script's provenance before allowing the agent to run it autonomously.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install trade-memory - After installation, invoke the skill by name or use
/trade-memory - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of trade-memory skill.
- Enables saving confirmed trade events or signals to a persistent local JSONL log file (trades.jsonl).
- Accepts and validates structured JSON trade data input, with auto-generated timestamp if missing.
- Safely appends each trade as one JSON line, auto-creating files/directories if needed.
- Returns a JSON confirmation on success or error on invalid input.
- Designed for easy integration with trade bots, agents, or manual logging.
Metadata
Frequently Asked Questions
What is Trade Memory?
Save a trade or signal event to local memory log file (trades.jsonl). Use when a trade signal is confirmed and needs to be recorded, saved, or logged for fut... It is an AI Agent Skill for Claude Code / OpenClaw, with 587 downloads so far.
How do I install Trade Memory?
Run "/install trade-memory" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Trade Memory free?
Yes, Trade Memory is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Trade Memory support?
Trade Memory is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Trade Memory?
It is built and maintained by Indra Riswana (@newbienodes); the current version is v1.0.0.
More Skills